OpenAI’s new GPT-6 Astra model makes fewer factual errors and blocks direct prompt injections at a near-perfect 99.99 percent rate, but hidden attacks buried inside documents remain a genuine vulnerability. According to OpenAI’s system card, Astra reproduced user-flagged errors far less often than its predecessor GPT-5.6 Sol, with the biggest improvements showing up at low latency settings and lower reasoning levels.
For direct prompt injections, OpenAI credits its GPT-Red method — an automated attacker used during training — for the 99.99 percent defense rate. Jailbreak resistance also improved against a fixed dataset of known attacks targeting biology, violence, and cybersecurity, with refusal rates between 91.5 and 98.3 percent. But when attackers adapt across multiple conversation rounds, that defense collapses to roughly 67 percent. Persistent adversaries get a problematic response about one in three tries. OpenAI notes these tests ran on the bare model without production safety classifiers.
The indirect injection numbers are more sobering. Security firm Gray Swan tested 1,810 curated attacks from its IPI Arena and found Astra was cracked at least once in 8.5 percent of scenarios with 15 attempts each. That’s a big improvement over GPT-5.6 Sol’s 27 percent failure rate, but Anthropic’s Claude Opus 5 did better at 4.8 percent. The combined Q1 and Q2 test scope pushed numbers up compared to earlier single-quarter results — Anthropic had previously reported just two percent for Opus 5 using the easier Q1 test alone.
For enterprise security teams, the practical math is uncomfortable. Astra gets tricked through injected instructions in roughly one out of every twelve scenarios; Opus 5 fails about one in twenty-one. That may sound acceptable until you consider what these agents are doing now — writing code, operating tools, controlling computers, running around the clock at scale. Reading and processing documents is core to their job. A failure rate in the single digits is real progress from the 27 percent we saw a generation ago, but it’s nowhere near the reliability bar for autonomous agents handling sensitive infrastructure.
